CVE-2026-53469: Migration-planner: unprotected delete endpoint wipes all tenant data
A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments, leading to a critical loss of availability and integrity across the entire SaaS platform.
Other sources
Repository: migration-planner Priority: High Location: internal/handlers/v1alpha1/source.go:74
Description: DELETE /api/v1/sources route is wired in openapi.yaml and calls sourceSrv.DeleteSources(ctx) with no filter. The service method runs Unscoped().Exec("DELETE FROM sources") against shared Postgres. No admin gate, no org scoping, no confirmation required.
Security Impact:
Any authenticated user can destroy all customers' sources, agents, and assessments
Single curl command causes total data loss across entire SaaS
Critical availability and integrity catastrophe
Fix Suggestion: Immediate: Hard-disable the handler (return 401 with explanatory message). Long-term: Either drop the route from openapi.yaml and delete SourceStore.DeleteAll, or re-implement as org-scoped bulk delete behind explicit edit permission. See patches/f004.patch.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch patches/f004.patch - Remove
Remove
migration-planner:/api/v1/sources (openapi.yaml route)from your environment.Remove the DELETE /api/v1/sources route from openapi.yaml (drop the route so it is not exposed) and remove any routing to the handler.
- Remove
Remove
migration-planner:SourceStore.DeleteAllfrom your environment.Delete the SourceStore.DeleteAll method (or equivalent unscoped delete implementation) to prevent unscoped deletion of all tenant data.
- Configuration
Hard-disable the DELETE /api/v1/sources handler immediately by changing it to return HTTP 401 with an explanatory message (prevent any authenticated user from invoking the deletion).
migration-planner handler DELETE /api/v1/sources authorization/enable = disabled / return 401 - Configuration
If bulk delete functionality is retained, re-implement it as an org-scoped bulk delete that enforces organization scoping and requires an explicit edit permission (do not allow unscoped or unauthorised deletes).
migration-planner source deletion implementation scoping/permission = org-scoped; require explicit edit permission
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53469?
CVE-2026-53469 has a critical severity rating of 9.1.
How does CVE-2026-53469 affect migration-planner?
CVE-2026-53469 allows an authenticated user to delete all tenant data by exploiting an unprotected DELETE endpoint.
What data is at risk due to CVE-2026-53469?
CVE-2026-53469 puts customer data including sources, agents, and assessments at risk of destruction.
How can I mitigate CVE-2026-53469?
To mitigate CVE-2026-53469, implement proper authorization and access controls on the DELETE endpoint.
What steps should be taken if CVE-2026-53469 is exploited?
If CVE-2026-53469 is exploited, immediate recovery measures should be taken to restore lost data and enhance security protocols.